Post cover image

July 23, 2026

Understanding HTTP Cookies: Login, Session Management, and Cookie Validation

Objective:

By Yasaswini Gaddam

4 min read

To understand how cookies work in web applications, how they're installed during login, and how browsers manage correct and incorrect cookie installations.

Protocol: HTTP — The Communication Protocol

  • HTTP (Hypertext Transfer Protocol) is a stateless protocol.
  • When you open a website, your browser is actually making an HTTP request to the server that hosts the website. The server responds by sending back the HTML, CSS, JS and images which your browser displays.
  • HTTP is stateless (HTTP can't remember previous interactions). This means every time you request something like opening a new page or refreshing, the server doesn't remember who you are or what you were doing before. Each request is treated as if it's coming from a completely new user — even if it's the same browser/person.

Protocol: Cookie — The Memory for HTTP

  • Cookie are small text files(key-value pairs) created by the server and stored in your browser. They allow server to identify and track user across multiple requests.
None 
sessionId=session123; Expires=Wed, 10 Apr 2025 10:00:00 GMT; Path=/; Secure; HttpOnly
  • sessionId=session123: This is a unique ID for your session.
  • Expires: When this cookie will expire.
  • Path: Where this cookie is valid on the website.
  • Secure: Cookie only sent over HTTPS.
  • HttpOnly: Can't be accessed by JavaScript (protects from XSS).

How It Works — Step-by-Step

  • You open a website: example.com
  • Browser sends this request:
GET / HTTP/1.1
Host: example.com

Server responds:

  • Shows login page.
  • No cookies yet because you're not logged in.

Login Flow with Cookies

Browser Server

None None
  1. Using Browser Developer Tools (DevTools)
  • Open the website.
  • Right-click > Inspect > Go to the Application tab.
  • Under Storage > Cookies, select the domain.
  • You'll see cookie details
None

Best for:

  • Frontend developers
  • Debugging login/session
  • Analyzing cookie settings
  1. Using Browser Network Tab (DevTools)

Cookies are also part of HTTP headers. We can inspect them in real-time requests:

  • Open Network tab in DevTools.
  • Refresh the page.
  • Click any HTTP request.
  • Look under Headers:
  • Request Headers → sent cookies (Cookie)
  • Response Headers → received cookies (Set-Cookie)
None

Best for:

  • Seeing cookie transmission in requests
  • Analyzing how servers send cookies
  1. Using Web Security Tools (e.g., Burp Suite, OWASP ZAP)

These tools help to inspect and manipulate cookies to test for:

  • Insecure cookie settings (e.g., no HttpOnly or Secure flags)
  • Session hijacking
  • Cross-site scripting (XSS)
  • Session fixation

In Burp, go to the Proxy tab → Intercept sub-tab → Ensure intercept is on. In your browser, visit the target website (e.g., Medium.com or a test site). You will see the request intercepted, Look for this cookies in the raw HTTP request.

Best for:

  • Ethical hacking / Pen testing
  • Analysing secure cookie practices
  1. Using Intercepting Proxies / Packet Sniffers (e.g., Wireshark)
  • Filter for HTTP packets in Wireshark.
  • Look at headers containing Cookie or Set-Cookie.

Best for:

  • Network-level analysis
  • Forensics or traffic inspection
None

To understand how cookies are set and validated during login, and analyse the behaviour of:

  • Correct cookie installation (valid login)
  • Incorrect cookie installation (manipulated or invalid cookies)

Tools Required:

  • Web Browser (e.g., Chrome or Firefox)
  • Burp Suite
  • A test web application with login (e.g., DVWA, bWAPP, WebGoat, or local Node.js app) for now, we are using DVWA.
  • Browser configured to route traffic through Burp's proxy

Start Burp and Set Proxy in Browser

Launch Burp: JAVA_CMD="/usr/lib/jvm/java-21-openjdk-amd64/bin/java" burpsuite

In Burp Suite → Proxy > Intercept → Intercept is ON → Open Browser > http://localhost/DVWA/login.php

Look at the Request:

None

Perform a Valid Login

Submit the form using these details:

  • Username: admin
  • Password: password
None

Burp will capture the POST request: POST /DVWA/login.php HTTP/1.1

None

In Response, observe:

  • Redirect to the home page or security page.
  • No new Set-Cookie → Server associates login with the existing session.
  1. In HTTP History, right-click the login POST → Send to Repeater
  2. Resend the same request (same PHPSESSID)
  3. Response → Still shows you're logged in
None

In Repeater:

Change this header:
Cookie: PHPSESSID=abc123456fakecookie
  • Send the request again

Response:

  • You'll likely be redirected to login.php
  • You are not logged in → invalid session rejected

The server responded with: HTTP/1.1 200 OK

And showed the login page: Login :: Damn Vulnerable Web Application (DVWA)

None

Session Hijacking : Stealing another user's session cookie.

Session Fixation : Attacker forces victim to use a known session ID.

Cross-Site Scripting (XSS) : Malicious JavaScript steals cookies (unless HttpOnly is enabled).

Cross-Site Request Forgery (CSRF) : Browser automatically sends cookies to another site.

Mitigation:

  • HttpOnly
  • Secure
  • SameSite
  • Session regeneration after login
  • HTTPS

Conclusion

Although HTTP is a stateless protocol, cookies enable web applications to maintain user sessions by storing a unique session identifier in the browser. Throughout this exercise, we explored how cookies are created during the login process, how browsers store and automatically send them with subsequent requests, and how servers use them to authenticate users. By inspecting cookies using browser Developer Tools, Burp Suite, and packet analysis tools, we gained a practical understanding of cookie transmission and session management. We also observed the difference between a valid session cookie and a manipulated one, demonstrating how servers reject invalid session identifiers to prevent unauthorized access. Finally, understanding common cookie-related attacks such as session hijacking, session fixation, XSS, and CSRF highlights the importance of implementing security measures like HttpOnly, Secure, SameSite, HTTPS, and session regeneration. Together, these concepts form the foundation of secure authentication and session management in modern web applications.